Open Source Vulnerabilities

Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp

System.Net.Requests, System.Net.Requests, System.Net.Requests

Microsoft Security Advisory CVE-2023-36049: .NET Elevation of Privilege Vulnerability

Microsoft.AspNetCore.Components, Microsoft.AspNetCore.Components, Microsoft.AspNetCore.Components

Microsoft Security Advisory CVE-2023-36558: .NET Security Feature Bypass Vulnerability

aiohttp

Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks

typo3/cms-install

Information Disclosure in typo3/cms-install tool

typo3/html-sanitizer, typo3/html-sanitizer

Bypassing Cross-Site Scripting Protection in TYPO3 HTML Sanitizer

Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation

github.com/sigstore/gitsign

Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.

Unsafe deserialization of user data in yiisoft/yii

github.com/hyperledger/fabric, github.com/hyperledger/fabric

Fabric vulnerable to crosslinking transaction attack

Crosslinking transaction attack in hyperledger/fabric

gpac

gpac, gpac, gpac, gpac, gpac, gpac

By-passing Cross-Site Scripting Protection in HTML Sanitizer

Information Disclosure in Install Tool in typo3/cms-install

Weak Authentication in Session Handling in typo3/cms-core